brcmfmac: Fix warning when hitting FW crash with flow control feature

Brcmfmac got warning message when hitting FW crash in TX throughput test
with fcmode=2. It's caused by FMAC flushed TXQ in brcmf_sdio_bus_stop
but without doing hanger slot cleanup. Therefore, we move
brcmf_remove_interface before brcmf_bus_stop to make sure the hanger
slot is clean when flushing TXQ.

[ 1891.512234] WARNING: CPU: 1 PID: 2765 at drivers/net/wireless/broadcom/brcm80211/brcmutil/utils.c:49 brcmu_pkt_buf_free_skb+0x21/0x30 [brcmutil]
[ 1891.512234] Modules linked in: brcmfmac(OE-) brcmutil(OE)
cfg80211(OE) compat(OE) rfkill mmc_block(OE) sdhci_pci(OE) sdhci(OE)
mmc_core(OE) ip6table_filter ip6_tables ebtable_nat ebtables
dns_resolver fscache e1000e ppdev iTCO_wdt iTCO_vendor_support tpm_tis
tpm_tis_core tpm mei_me mei pcspkr lpc_ich i2c_i801 mfd_core ptp
pps_core parport_pc parport wmi tcp_bic uinput i915 iosf_mbi
i2c_algo_bit drm_kms_helper drm i2c_core video [last unloaded: brcmfmac]
[ 1891.512247] CPU: 1 PID: 2765 Comm: rmmod Tainted: G        W  OE
4.12.0 #1
[ 1891.512247] Hardware name:                  /DH77EB, BIOS
EBH7710H.86A.0100.2013.0312.1351 03/12/2013
[ 1891.512248] task: ffff880118f08000 task.stack: ffffc90001180000
[ 1891.512249] RIP: 0010:brcmu_pkt_buf_free_skb+0x21/0x30 [brcmutil]
[ 1891.512249] RSP: 0018:ffffc90001183cc0 EFLAGS: 00010086
[ 1891.512250] RAX: 0000000000000000 RBX: 0000000000000000 RCX:
0000000000000006
[ 1891.512251] RDX: 0000000000000000 RSI: 0000000000000086 RDI:
ffff880118e3ab00
[ 1891.512251] RBP: ffffc90001183cc0 R08: 0000000000000000 R09:
000000000000a050
[ 1891.512252] R10: 0000000000000001 R11: 0000000000aaaaaa R12:
00000000000000bc
[ 1891.512253] R13: ffff880118b40c78 R14: 0000000000000002 R15:
ffff880118e3ab00
[ 1891.512253] FS:  00007f2a49760740(0000) GS:ffff88011f280000(0000)
knlGS:0000000000000000
[ 1891.512254] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1891.512254] CR2: 00000000012994a8 CR3: 000000011a3c4000 CR4:
00000000001406e0
[ 1891.512255] Call Trace:
[ 1891.512259]  brcmf_fws_cleanup+0x1ea/0x240 [brcmfmac]
[ 1891.512264]  brcmf_fws_detach+0x42/0x60 [brcmfmac]
[ 1891.512268]  brcmf_proto_bcdc_detach+0x26/0x40 [brcmfmac]
[ 1891.512273]  brcmf_proto_detach+0x57/0x70 [brcmfmac]
[ 1891.512277]  brcmf_detach+0x89/0x100 [brcmfmac]
[ 1891.512282]  brcmf_sdio_remove+0x76/0x180 [brcmfmac]
[ 1891.512286]  brcmf_sdiod_remove+0x25/0xb0 [brcmfmac]
[ 1891.512291]  brcmf_ops_sdio_remove+0xbd/0x120 [brcmfmac]
[ 1891.512294]  sdio_bus_remove+0x33/0x100 [mmc_core]
[ 1891.512295]  device_release_driver_internal+0x141/0x200
[ 1891.512297]  driver_detach+0x38/0x70
[ 1891.512298]  bus_remove_driver+0x55/0xd0
[ 1891.512299]  driver_unregister+0x2c/0x50
[ 1891.512303]  sdio_unregister_driver+0x1a/0x20 [mmc_core]
[ 1891.512307]  brcmf_sdio_exit+0x2f/0x40 [brcmfmac]
[ 1891.512312]  brcmf_core_exit+0x15/0xd7 [brcmfmac]
[ 1891.512316]  __exit_compat+0x9/0x2b [brcmfmac]
[ 1891.512318]  SyS_delete_module+0x155/0x230
[ 1891.512319]  ? exit_to_usermode_loop+0x70/0x99
[ 1891.512321]  do_syscall_64+0x54/0xc0
[ 1891.512322]  entry_SYSCALL64_slow_path+0x25/0x25

Signed-off-by: Wright Feng <wright.feng@cypress.com>
Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200928054922.44580-2-wright.feng@cypress.com

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index aa9ced3..b0465f8 100644 (file)
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -1422,6 +1422,11 @@ void brcmf_detach(struct device *dev)
 #endif
 
        brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN);
+       /* make sure primary interface removed last */
+       for (i = BRCMF_MAX_IFS - 1; i > -1; i--) {
+               if (drvr->iflist[i])
+                       brcmf_remove_interface(drvr->iflist[i], false);
+       }
        brcmf_bus_stop(drvr->bus_if);
 
        brcmf_fweh_detach(drvr);
@@ -1432,12 +1437,6 @@ void brcmf_detach(struct device *dev)
                drvr->mon_if = NULL;
        }
 
-       /* make sure primary interface removed last */
-       for (i = BRCMF_MAX_IFS - 1; i > -1; i--) {
-               if (drvr->iflist[i])
-                       brcmf_del_if(drvr, drvr->iflist[i]->bsscfgidx, false);
-       }
-
        if (drvr->config) {
                brcmf_p2p_detach(&drvr->config->p2p);
                brcmf_cfg80211_detach(drvr->config);